Andrew, I can't completely agree with you. I can write Snort rules a well
and at my point of view the power of open rules is that IDS admin can
easily correct these rules or write filters which correspond to their LAN.
This will help to mitigate false positives (FPs) and will clarify what's
exactly going on in LAN.
Yes, you're right that most of admis do not perform special tuning for
their IDS - may be this is the reason for thinking that great amount FPs is
big problem of IDSs - but vendor should not think in this way... Vendor
should provide means to mitigate FPs and false negatives (FNs) and it's up
to admin to do something or not.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50 (1613)
"Andrew Plato"
<andrew.plato@anitian.com To: "Joshua Berry"
<jberry@PENSON.COM>
> cc:
<focus-ids@securityfocus.com>
Subject: RE: How to choose an
IDS/FW MSS provider
15.03.2005 19:06
1. I know ISS's language to some extent because I helped develop the
engine inside their product (I worked at Network ICE before ISS bought
them.) Some are simple pattern matches, many are not.
2. I am familiar with Snort's rules (although I do not profess to be an
expert). I also know that Snort's rules, while very powerful and
flexible, are WELL beyond the capability of 90% of the IT and network
admins in the world. Most organizations don't take the time (nor do they
have the time) to analyze signatures. They are more consumed with things
like productivity and performance. I know this from my experience (10+
years) as an IT consultant.
Thus my point - while seeing the details of a signature is fascinating
to security geeks, it is not terribly important to the vast majority of
IT admins. As such, I don't think the ability to see signature specs is
an important measure of the value of an IPS/IDS product. It may be
important to security nerds, but the general IT/network admin population
doesn't care that much. And frankly, products that do show their
signature details are rarely changed anyways.
___________________________________
Andrew Plato, CISSP
President/Principal Consultant
ANITIAN ENTERPRISE SECURITY
3800 SW Cedar Hills Blvd, Suite 280
Beaverton, OR 97005
503-644-5656 Office
503-214-8069 Fax
503-201-0821 Mobile
www.anitian.com
___________________________________
GPG fingerprint: 16E6 C5B0 B6CB F287 776E E9A9 AF47 9914 3582 633D
GPG public key available at: http://www.anitian.com/corp/keys.htm
-----Original Message-----
From: Joshua Berry [mailto:jberry@PENSON.COM]
Sent: Tuesday, March 15, 2005 6:50 AM
To: Andrew Plato; Stephane; rick.brady@libertymutual.com
Cc: focus-ids@securityfocus.com
Subject: RE: How to choose an IDS/FW MSS provider
Since you can't see the signature, how do you know they aren't doing
simple string matching? Second, obviously you aren't very familiar with
Snort's rule language, it isn't just simple string matching, there is a
*ton* of other logic available to reduce false positives/negatives.
Snort also has conveniently had support for PCRE matching for a long
time now.
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
